Sure, that's a valid but separate concern. You'd have to ask the dev team what their precise security approach is.